As @SlickSim mentioned in comment, they are stored on the heap as reference types are in .net.
ViewBag
is of type dynamic
but, is internally an System.Dynamic.ExpandoObject()
It is declared like this:
dynamic ViewBag = new System.Dynamic.ExpandoObject();
which is why you can do :
ViewBag.Foo = "Bar";
Inheritance Hierarchy:
System.Object
System.Dynamic.ExpandoObject
For more info on ExpandoObject
Please go through this article on Value type, reference type, heap and stack on codeproject that may help you to understand where both ViewData and Viewbag reside.
I hope it helps!